Security

Reporting a vulnerability

If you've found a security issue in LeakWatch itself — the site, the API, the OAuth flow, anything that isn't a leak LeakWatch detected in someone else's repository — email me directly:

[email protected]

Include what you found, how to reproduce it, and what you think the impact is. I read this inbox myself — see /about for who that is.

Scope

In scope:

• leakwatch.net and its API (api.leakwatch.net or /api/*)
• The OAuth / session flow, billing flow, and public report links (/r/:token)

Out of scope:

• Secrets LeakWatch detected in third-party repositories — that's the product working as intended, not a vulnerability in it
• Denial-of-service testing, automated scanners run against production without asking first
• Social engineering, physical access, or anything targeting me rather than the Service

What to expect

I'm one person running this alongside my studies, so there's no bug-bounty payout and no SLA I can legally commit to — but I do take reports seriously and act on them fast. In practice: acknowledgment within a few days, and a fix or mitigation shipped well before any public disclosure. If I go quiet longer than that, follow up — it means the email got lost, not that it was ignored.

Responsible disclosure

Please give me a reasonable window to fix an issue before writing about it publicly. I'm not going to threaten anyone who reports in good faith — testing against your own account, without touching other users' data, is fine.